CVE-2009-0411: Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and...

Security readout for executives and security teams

Older Google Chrome versions could let a web page read cookie-setting response headers that should be hidden from scripts. If a user browsed with Chrome before 1.0.154.46, a malicious page could expose sensitive cookie information. This is mainly a legacy-browser risk today. Exposure is limited to systems still running Google Chrome before 1.0.154.46. Modern managed fleets are unlikely to be affected, but legacy kiosks, lab machines, or unmanaged endpoints should be checked. Treat this as a legacy hygiene issue unless affected Chrome versions are present. If found on systems accessing sensitive web apps, prioritize removal because cookie exposure can undermine session confidentiality. Mitigation focus: Upgrade affected Chrome installations beyond 1.0.154.46 or to a supported current release.; Remove unsupported Chrome builds from managed endpoints and gold images.; Block obsolete browser versions from accessing sensitive internal applications..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.